commit 94a6621c6d141cb2e4207d899ba9b371d1b48bea
parent 31c5151723d1a6f2564baac66465294866c01e22
Author: MTRNord <mtrnord1@gmail.com>
Date: Wed, 8 Jan 2025 11:03:18 +0100
Deploy mailserver
Diffstat:
8 files changed, 314 insertions(+), 13 deletions(-)
diff --git a/apps/2024_cluster/kustomization.yaml b/apps/2024_cluster/kustomization.yaml
@@ -36,3 +36,4 @@ resources:
- ../base/jenkins
- ../base/mariadb-operator
- ../base/osticket
+ - ../base/mailserver
diff --git a/apps/2024_cluster/namespaces/kustomization.yaml b/apps/2024_cluster/namespaces/kustomization.yaml
@@ -25,3 +25,4 @@ resources:
- jenkins.yaml
- mariadb-operator.yaml
- osticket.yaml
+ - mailserver.yaml
diff --git a/apps/2024_cluster/namespaces/mailserver.yaml b/apps/2024_cluster/namespaces/mailserver.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+ name: mailserver
diff --git a/apps/base/mailserver/certificate.yaml b/apps/base/mailserver/certificate.yaml
@@ -0,0 +1,12 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+ name: mail.midnightthoughts.space
+ namespace: mailserver
+spec:
+ secretName: mail.midnightthoughts.space-tls
+ dnsNames:
+ - mail.midnightthoughts.space
+ issuerRef:
+ name: letsencrypt-dns
+ kind: ClusterIssuer
diff --git a/apps/base/mailserver/kustomization.yaml b/apps/base/mailserver/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: mailserver
+resources:
+ - repository.yaml
+ - release.yaml
diff --git a/apps/base/mailserver/release.yaml b/apps/base/mailserver/release.yaml
@@ -0,0 +1,282 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
+metadata:
+ name: mailserver
+ namespace: mailserver
+spec:
+ releaseName: mailserver
+ interval: 60m
+ chart:
+ spec:
+ chart: docker-mailserver
+ sourceRef:
+ kind: HelmRepository
+ name: mailserver
+ values:
+ certificate: mail.midnightthoughts.space-tls
+ deployment:
+ strategy:
+ type: RollingUpdate
+ env:
+ OVERRIDE_HOSTNAME: mail.midnightthoughts.space
+ # -----------------------------------------------
+ # --- General Section ---------------------------
+ # -----------------------------------------------
+ LOG_LEVEL: info
+ SUPERVISOR_LOGLEVEL:
+ DMS_VMAIL_UID:
+ DMS_VMAIL_GID:
+ ACCOUNT_PROVISIONER:
+ POSTMASTER_ADDRESS: postmaster@mail.midnightthoughts.space
+ ENABLE_UPDATE_CHECK: 1
+ UPDATE_CHECK_INTERVAL: 1d
+ PERMIT_DOCKER: none
+ TZ: Europe/Berlin
+ NETWORK_INTERFACE:
+ TLS_LEVEL:
+ SPOOF_PROTECTION:
+ ENABLE_SRS: 0
+ ENABLE_OPENDKIM: 0
+ ENABLE_OPENDMARC: 0
+ ENABLE_POLICYD_SPF: 0
+ ENABLE_POP3: 0
+ ENABLE_IMAP: 1
+ ENABLE_CLAMAV: 0
+ ENABLE_RSPAMD: 1
+ ENABLE_RSPAMD_REDIS: 1
+ RSPAMD_LEARN: 1
+ RSPAMD_CHECK_AUTHENTICATED: 0
+ RSPAMD_GREYLISTING: 1
+ RSPAMD_HFILTER: 1
+ RSPAMD_HFILTER_HOSTNAME_UNKNOWN_SCORE: 6
+ RSPAMD_NEURAL: 0
+ ENABLE_AMAVIS: 0
+ AMAVIS_LOGLEVEL: 0
+ ENABLE_DNSBL: 0
+ ENABLE_FAIL2BAN: 0
+ FAIL2BAN_BLOCKTYPE: drop
+ ENABLE_MANAGESIEVE:
+ POSTSCREEN_ACTION: enforce
+ SMTP_ONLY:
+ # These values are automatically set by the chart based on the certificate key
+ # SSL_TYPE:
+ # SSL_CERT_PATH:
+ # SSL_KEY_PATH:
+ SSL_ALT_CERT_PATH:
+ SSL_ALT_KEY_PATH:
+ VIRUSMAILS_DELETE_DELAY:
+ POSTFIX_DAGENT:
+ POSTFIX_MAILBOX_SIZE_LIMIT:
+ ENABLE_QUOTAS: 1
+ POSTFIX_MESSAGE_SIZE_LIMIT:
+ CLAMAV_MESSAGE_SIZE_LIMIT:
+ PFLOGSUMM_TRIGGER:
+ PFLOGSUMM_RECIPIENT:
+ PFLOGSUMM_SENDER:
+ LOGWATCH_INTERVAL:
+ LOGWATCH_RECIPIENT:
+ LOGWATCH_SENDER:
+ REPORT_RECIPIENT:
+ REPORT_SENDER:
+ LOGROTATE_COUNT: 4
+ LOGROTATE_INTERVAL: weekly
+ POSTFIX_REJECT_UNKNOWN_CLIENT_HOSTNAME: 0
+ POSTFIX_INET_PROTOCOLS: all
+ DOVECOT_INET_PROTOCOLS: all
+ # -----------------------------------------------
+ # --- SpamAssassin Section ----------------------
+ # -----------------------------------------------
+ ENABLE_SPAMASSASSIN: 0
+ ENABLE_SPAMASSASSIN_KAM: 0
+ SPAMASSASSIN_SPAM_TO_INBOX: 1
+ MOVE_SPAM_TO_JUNK: 1
+ MARK_SPAM_AS_READ: 0
+ SA_TAG: 2.0
+ SA_TAG2: 6.31
+ SA_KILL: 10.0
+ SPAM_SUBJECT: "***SPAM*** "
+ # -----------------------------------------------
+ # --- Fetchmail Section -------------------------
+ # -----------------------------------------------
+ ENABLE_FETCHMAIL: 0
+ FETCHMAIL_POLL: 300
+ FETCHMAIL_PARALLEL: 0
+ ENABLE_GETMAIL: 0
+ GETMAIL_POLL: 5
+ # -----------------------------------------------
+ # --- LDAP Section ------------------------------
+ # -----------------------------------------------
+ LDAP_START_TLS:
+ LDAP_SERVER_HOST:
+ LDAP_SEARCH_BASE:
+ LDAP_BIND_DN:
+ LDAP_BIND_PW:
+ LDAP_QUERY_FILTER_USER:
+ LDAP_QUERY_FILTER_GROUP:
+ LDAP_QUERY_FILTER_ALIAS:
+ LDAP_QUERY_FILTER_DOMAIN:
+ # -----------------------------------------------
+ # --- Dovecot Section ---------------------------
+ # -----------------------------------------------
+ DOVECOT_TLS:
+ DOVECOT_USER_FILTER:
+ DOVECOT_PASS_FILTER:
+ DOVECOT_MAILBOX_FORMAT: maildir
+ DOVECOT_AUTH_BIND:
+ # -----------------------------------------------
+ # --- Postgrey Section --------------------------
+ # -----------------------------------------------
+ ENABLE_POSTGREY: 0
+ POSTGREY_DELAY: 300
+ POSTGREY_MAX_AGE: 35
+ POSTGREY_TEXT: "Delayed by Postgrey"
+ POSTGREY_AUTO_WHITELIST_CLIENTS: 5
+ # -----------------------------------------------
+ # --- SASL Section ------------------------------
+ # -----------------------------------------------
+ ENABLE_SASLAUTHD: 0
+ SASLAUTHD_MECHANISMS:
+ SASLAUTHD_MECH_OPTIONS:
+ SASLAUTHD_LDAP_SERVER:
+ SASLAUTHD_LDAP_BIND_DN:
+ SASLAUTHD_LDAP_PASSWORD:
+ SASLAUTHD_LDAP_SEARCH_BASE:
+ SASLAUTHD_LDAP_FILTER:
+ SASLAUTHD_LDAP_START_TLS:
+ SASLAUTHD_LDAP_TLS_CHECK_PEER:
+ SASLAUTHD_LDAP_TLS_CACERT_FILE:
+ SASLAUTHD_LDAP_TLS_CACERT_DIR:
+ SASLAUTHD_LDAP_PASSWORD_ATTR:
+ SASLAUTHD_LDAP_AUTH_METHOD:
+ SASLAUTHD_LDAP_MECH:
+ # -----------------------------------------------
+ # --- SRS Section -------------------------------
+ # -----------------------------------------------
+ SRS_SENDER_CLASSES: envelope_sender
+ SRS_EXCLUDE_DOMAINS:
+ SRS_SECRET:
+ # -----------------------------------------------
+ # --- Default Relay Host Section ----------------
+ # -----------------------------------------------
+ DEFAULT_RELAY_HOST:
+ # -----------------------------------------------
+ # --- Multi-Domain Relay Section ----------------
+ # -----------------------------------------------
+ RELAY_HOST:
+ RELAY_PORT: 25
+ RELAY_USER:
+ RELAY_PASSWORD:
+ service:
+ type: NodePort
+ nodePort:
+ smtp: 25
+ smtps: 465
+ submission: 587
+ imap: 143
+ imaps: 993
+ persistence:
+ mail-config:
+ accessMode:
+ - ReadWriteMany
+ storageClass: ceph-filesystem
+ mail-data:
+ accessMode:
+ - ReadWriteMany
+ storageClass: ceph-filesystem
+ mail-state:
+ accessMode:
+ - ReadWriteMany
+ storageClass: ceph-filesystem
+ mail-log:
+ accessMode:
+ - ReadWriteMany
+ storageClass: ceph-filesystem
+ rspamd:
+ ingress:
+ enabled: true
+ ingressClassName: traefik
+ annotations:
+ cert-manager.io/cluster-issuer: letsencrypt-dns
+ external-dns.alpha.kubernetes.io/hostname: midnightthoughts.space
+ host: rspamd.midnightthoughts.space
+ tls:
+ enabled: true
+ secretName: rspamd.midnightthoughts.space-tls
+ proxyProtocol:
+ enabled: false
+ configMaps:
+ custom-commands.conf:
+ create: true
+ path: dms/config/rspamd/custom-commands.conf
+ data: |
+ set-option-for-controller password "$2$q19y9w4kqeh1568zhy1ipszk6zx5usid$n3giktipbsr7pbef9b6n566jk4ggd147qrrhg5xtmauh6w4yoj5y"
+ dovecot.cf:
+ create: true
+ path: dovecot.cf
+ data: "{{- if .Values.proxyProtocol.enabled }}\n haproxy_trusted_networks = {{ .Values.proxyProtocol.trustedNetworks
+ }}\n\n {{- if and (.Values.deployment.env.ENABLE_IMAP) (not .Values.deployment.env.SMTP_ONLY) }}\n
+ \ service imap-login {\n inet_listener imap {\n port = 143\n }\n \n inet_listener
+ imaps {\n port = 993\n ssl = yes\n }\n \n inet_listener imap_proxy
+ {\n haproxy = yes\n port = 10143\n ssl = no\n }\n\n inet_listener
+ imaps_proxy {\n haproxy = yes\n port = 10993\n ssl = yes\n }\n
+ \ } \n {{- end -}}\n\n {{- if and (.Values.deployment.env.ENABLE_POP3) (not .Values.deployment.env.SMTP_ONLY)
+ }}\n service pop3-login {\n inet_listener pop3 {\n port = 110\n }\n \n
+ \ inet_listener pop3s {\n port = 995\n ssl = yes\n }\n\n inet_listener
+ pop3_proxy {\n haproxy = yes\n port = 10110\n ssl = no\n }\n\n
+ \ inet_listener pop3s_proxy {\n haproxy = yes\n port = 10995\n ssl
+ = yes\n } \n }\n {{- end -}}\n{{- end -}}\n"
+ fts-xapian-plugin.conf:
+ create: true
+ path: /etc/dovecot/conf.d/10-plugin.conf
+ data: |
+ {{- if .Values.dovecot.fullTextSearch.enabled }}
+ mail_plugins = $mail_plugins fts fts_xapian
+
+ plugin {
+ fts_decoder = decode2text
+ }
+
+ plugin {
+ fts = xapian
+ fts_xapian = partial=3 full=20 verbose={{ .Values.dovecot.fullTextSearch.verbose }}
+
+ fts_autoindex = yes
+ fts_enforced = yes
+
+ # Index attachements
+ fts_decoder = decode2text
+ }
+
+ service indexer-worker {
+ # limit size of indexer-worker RAM usage, ex: 512MB, 1GB, 2GB
+ vsz_limit = {{ .Values.dovecot.fullTextSearch.resources.memory }}
+ }
+
+ service decode2text {
+ executable = script /usr/lib/dovecot/decode2text.sh
+ user = dovecot
+ unix_listener decode2text {
+ mode = 0666
+ }
+ }
+ {{- end -}}
+ user-patches.sh:
+ create: true
+ path: user-patches.sh
+ data: "#!/bin/bash\n\n{{- if .Values.proxyProtocol.enabled }}\n# Make sure to keep this file in sync with
+ https://github.com/docker-mailserver/docker-mailserver/blob/master/target/postfix/master.cf!\ncat <<EOS
+ >> /etc/postfix/master.cf\n\n# Submission with proxy\n10587 inet n - n - -
+ \ smtpd\n -o syslog_name=postfix/submission\n -o smtpd_tls_security_level=encrypt\n -o smtpd_sasl_auth_enable=yes\n
+ \ -o smtpd_sasl_type=dovecot\n -o smtpd_reject_unlisted_recipient=no\n -o smtpd_sasl_authenticated_header=yes\n
+ \ -o smtpd_client_restrictions=permit_sasl_authenticated,reject\n -o smtpd_relay_restrictions=permit_sasl_authenticated,reject\n
+ \ -o smtpd_sender_restrictions=\\$mua_sender_restrictions\n -o smtpd_discard_ehlo_keywords=\n -o
+ milter_macro_daemon_name=ORIGINATING\n -o cleanup_service_name=sender-cleanup\n -o smtpd_upstream_proxy_protocol=haproxy
+ \ \n\n# Submissions with proxy\n10465 inet n - n - - smtpd\n -o
+ syslog_name=postfix/submissions\n -o smtpd_tls_wrappermode=yes\n -o smtpd_sasl_auth_enable=yes\n
+ \ -o smtpd_sasl_type=dovecot\n -o smtpd_reject_unlisted_recipient=no\n -o smtpd_sasl_authenticated_header=yes\n
+ \ -o smtpd_client_restrictions=permit_sasl_authenticated,reject\n -o smtpd_relay_restrictions=permit_sasl_authenticated,reject\n
+ \ -o smtpd_sender_restrictions=\\$mua_sender_restrictions\n -o smtpd_discard_ehlo_keywords=\n -o
+ milter_macro_daemon_name=ORIGINATING\n -o cleanup_service_name=sender-cleanup\n -o smtpd_upstream_proxy_protocol=haproxy\n\n#
+ Smtp with proxy\n12525 inet n - n - 1 postscreen\n -o syslog_name=postfix/smtp-proxy\n
+ \ -o postscreen_upstream_proxy_protocol=haproxy\n -o postscreen_cache_map=btree:$data_directory/postscreen_10025_cache\nEOS\n{{-
+ end }}\n\n{{- if .Values.dovecot.fullTextSearch.enabled }}\n"
diff --git a/apps/base/mailserver/repository.yaml b/apps/base/mailserver/repository.yaml
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+ name: mailserver
+ namespace: mailserver
+spec:
+ interval: 8h
+ url: https://docker-mailserver.github.io/docker-mailserver-helm
diff --git a/apps/base/mariadb-operator/mariadb.yaml b/apps/base/mariadb-operator/mariadb.yaml
@@ -7,11 +7,9 @@ spec:
name: mariadb-root
key: root-password
generate: true
-
storage:
size: 5Gi
storageClassName: hcloud-volumes
-
# Recreate the MariaDB resource and bootstrap from a backup in S3.
# bootstrapFrom:
# s3:
@@ -44,24 +42,19 @@ spec:
# memory: 128Mi
# limits:
# memory: 1Gi
-
replicas: 3
-
galera:
enabled: true
config:
reuseStorageVolume: true
-
metrics:
enabled: true
-
updateStrategy:
type: ReplicasFirstPrimaryLast
# Pause updates.
# type: Never
# Update the data-plane after an operator upgrade.
autoUpdateDataPlane: true
-
# Configure enough compute resources. This is just an example, take a look at your historic compute metrics to estimate.
resources:
requests:
@@ -69,19 +62,16 @@ spec:
memory: 250Mi
limits:
memory: 4Gi
-
# Tune your liveness probe accordingly to avoid Pod restarts.
livenessProbe:
initialDelaySeconds: 20
periodSeconds: 5
timeoutSeconds: 5
-
# Tune your readiness probe accordingly to prevent disruptions in network traffic.
readinessProbe:
initialDelaySeconds: 20
periodSeconds: 5
timeoutSeconds: 5
-
# innodb_buffer_pool_size: 80% of memory limits.
myCnf: |
[mariadb]
@@ -91,15 +81,12 @@ spec:
innodb_autoinc_lock_mode=2
innodb_buffer_pool_size=3200MB
max_allowed_packet=1GB
-
# Schedule Pods in different Nodes to achieve real HA.
affinity:
antiAffinityEnabled: true
-
# When draining Nodes, make sure that you have at least 2 Pods available.
podDisruptionBudget:
maxUnavailable: 66%
-
maxScale:
enabled: true
kubernetesService:
